Combicard transaction method and system having an application parameter update mechanism

ABSTRACT

Systems, methods and IC card devices are described for updating parameters such as unblocking or blocking or re-blocking an application on an IC card device whereby an integrated circuit card device gets issued with one or more active applications and optionally one or more dormant applications. Post issuance, triggered by a cardholder action when using a primary application, the issuer will send a command, e.g. in the form of a script to the card that will update parameters of another application, e.g. to ‘wake up’ the or each dormant application. An on-card mechanism is provided for the deblocking of the dormant application while the primary application is active. For any further transactions performed with the card, the cardholder will be offered a choice between the unblocked applications on the card. Optionally the oncard mechanism can also block or re-block an application or perform other actions.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/657,301, filed Mar. 13, 2015 and entitled “COMBICARD TRANSACTIONMETHOD AND SYSTEM HAVING AN APPLICATION PARAMETER UPDATE MECHANISH”,which is a continuation of Ser. No. 14/010,907, filed Aug. 27, 2013, nowissued as U.S. Pat. No. 9,010,631, which is a continuation of U.S.patent application Ser. No. 13/478,367, filed May 23, 2012, now issuedas U.S. Pat. No. 8,544,735, and claims benefit and priority of, U.S.Patent Application Ser. No. 61/488,985, filed on May 23, 2011, thecontents of which are incorporated herein in their entirety for allpurposes.

FIELD

Embodiments of the present invention generally relate to a system andmethod for performing transactions with an integrated circuit card orsmartcard with multiple applications thereon (such as a combicard orcombocard) and more particularly relates to a system and method forupdating parameters of an application such as deblocking a dormantapplication on such an integrated circuit card or smartcard.

BACKGROUND

With the advancement of the computer industry, the use of so-calledintegrated circuit cards or smartcards has become a preferred method ofperforming transactions on networks in many countries. For example suchcards can be used as payment cards and this simplifies the purchase ofgoods and/or services by avoiding the necessity of using cash for suchtransactions while improving security compared to magstripe cards. Thesepayment cards are often used in conjunction with electronic payment cardor card accepting terminals (generally referred to herein as cardreading terminals, point of sale terminals, or card readers).

Credit cards and debit cards are known. In recent years, an electronicwallet system has been suggested in which a monetary amount can beexchanged by communication between integrated circuit (“IC”) cards orbetween an IC card and a point of sale (“POS”) terminal. The IC cardused for this system includes a microprocessor having a communicationfunction and a memory such as electrically erasable programmableread-only memory (“EEPROM”) for storing a processing program, such asthe MONDEX™ electronic cash application developed by MondexInternational, Ltd. The processing program is capable of configuring theIC card to function as a credit card, a debit card or an electronic cashcard.

If configured to function as a cash card, the IC card can be used foroffline commercial transactions of merchandises, commodities and thelike, and to allow information or data representing a monetary amount tobe stored in a memory incorporated in the IC card. When the IC card runsout of electronic cash, the cardholder must deposit additional cash ontothe IC card using a specialized terminal.

A typical message flow is as follows:

-   -   1) The terminal selects the application to use for the        transaction (e.g. credit application) e.g. after selection by        the cardholder.    -   2) The application (e.g. credit) is activated. The application        prepares a message for the Issuer. The terminal forwards this        message to the Issuer.    -   3) Based on the received message, the Issuer prepares the        response (i.e. accept or not the transaction) and, possibly, a        script command to be processed by the active application. The        Issuer can only prepare the response and the script command        after receiving the request from application. The command is        delivered by the terminal to the card.    -   4) The transaction is approved or declined and the script        command is processed by the active application (credit).

It is inconvenient for consumers to carry multiple cards to conductmultiple types of transactions (such as one card for use as a debitcard, and another card for use as a credit card). As a result, cardshave been offered that allow a plurality of applications on one card.These cards are referred to herein as “combicards,” “combo cards” or“multi-application cards”.

In a typical transaction involving the purchase of an item or service,the payment device (such as the combo card or combicard) is presented ata point of sale terminal (“POS terminal”). The POS terminal has a cardreader that can read data stored on the payment device. Dependent onwhether the payment device is configured as a cash, credit or debit cardor a combination of these, relevant identifying information for eachapplication is displayed in some way to the user for selection. For thecard to be configured as a cash card, credit card, debit card or othertype of device, the cardholder must have obtained prior approval fromthe card issuer to use the application(s) and as a result, everyapplication on the payment device must be authorized.

A user may only wish to use an application for a short period of time.For example, a traveler visiting another country may wish to use anapplication that allows the traveler to conduct transactions in thecurrency of the country she will be visiting. This would require loadingthe new application onto the card. It is known to place more than oneapplication on such a card but to make some of them dormant or “blocked”such that they cannot be used and cannot be seen at the POS terminal.Such a blocked application can be unblocked by presenting the card at adedicated terminal (e.g. at a bank branch terminal equipped with specialsoftware). In this case, if the user wishes to make use of a newapplication, the card is introduced into the dedicated terminal, and theapplication running on the dedicated terminal selects the application tounblock on the card. The application on the card is then activated foruse. The application on the card then prepares a message for the Issuer.The terminal forwards this message to the Issuer. Based on the receivedmessage, the Issuer prepares a script command to unblock the activeapplication. The Issuer can only prepare the response (causing theapplication to be unblocked for use) after receiving the request fromthe blocked application. The command is delivered by the terminal to thecard and the application is unblocked. This message flow requires that ablocked application can be activated while still in the blocked state.This is typically only allowed in a safe environment, e.g. using adedicated terminal within a bank's premises.

This is somewhat more convenient than having to load the complete newapplication onto the card. However it still requires that the user takethe card to the location of the dedicated terminal and interact with thededicated terminal to activate the application.

A further difficulty is that existing payment network infrastructuresimpose limitations on how communications can be made with an IC card ata POS terminal. Only one application can be activated at one time forsecurity reasons. The payment networks allow for only one request, fromonly one application. An online authorization (e.g., such as a requestfor a payment authorization) can only be performed with an applicationthat is not blocked. The issuer needs a request from the blockedapplication to unblock it, but as it is blocked this cannot occur. As aresult, currently, blocked applications cannot be unblocked at the POSterminal. This causes an inconvenience to the issuer. It would bepreferred if new applications could be made available to the user in amore flexible and convenient manner.

SUMMARY

An object of some embodiments of the present invention is to provide amethod and system for providing a more flexible and convenient way toupdate parameters of an application, e.g. for unblocking of a dormantapplication and/or blocking or an application and/or re-blocking of aunblocked application on a combi-or combo IC card system. Another objectof the present invention is to provide on a combi-or combo IC card foruse with such a method and system. The card can be a payment devicehaving a microprocessor adapted to provide more than one application.

In accordance with some embodiments of the present invention, a methodof updating parameters such as unblocking or blocking or re-blocking anapplication on an IC card is provided whereby an integrated circuit cardgets issued with one or more active applications and optionally one ormore dormant applications. Post issuance, triggered by a cardholderaction when using a primary application, the issuer will send a command,e.g. in the form of a script to the card that will update parameters ofanother application, e.g. to ‘wake up’ the or each dormant application.In an embodiment an on-card mechanism is provided for the deblocking ofthe dormant application while the primary application is active. For anyfurther transactions performed with the card, the cardholder will beoffered a choice between the unblocked applications on the card.Optionally the oncard mechanism can also block or re-block anapplication or perform other actions.

An advantage of some embodiments of the present invention is that theupdate of the parameter of a second application, e.g. unblocking orblocking or re-blocking can be done through an updating procedure thatcan be controlled by the issuer and applied by the cardcontemporaneously with the card's processing of a primary applicationwithout requiring a special dedicated terminal.

In one embodiment, the present invention provides a method of updating aparameter of a secondary application. For example, deblocking a dormantapplication on an IC card device during a transaction of a primaryapplication between an issuer node and the IC card device via a terminalacross a network, update information for the change of parameter, e.g.for deblocking the blocked secondary application, being routed throughthe network to the IC card device during a transaction of the primaryapplication, each transaction being routed at an application layer fromthe issuer node to the terminal, the IC card device being issued by anissuer or an agent of the issuer, the update information beingtransferred by the terminal to the IC card device associated to acommand of the primary application, and the IC card device being adaptedto record the update information in non-volatile memory to therebychange the parameter of the secondary application, e.g. to therebydeblock the dormant application.

The updating of the secondary application occurs while the primaryapplication is active. The method is applicable in systems where onlyone application on the IC card device can be active at one time.

The IC card can be a combo-or combicard having one microprocessor andassociated non-volatile and volatile memory. The IC card can be apayment device.

A wireless and/or a wired connection can be used between the terminaland the IC card. In some cases a combination of wireless and wiredcommunication may be used to further increase the level of security. Apredefined sequence of commands may be for instance required to betransmitted or received individually over a certain interface. If theexpected predefined sequence of commands is not maintained a securitybreach may be assumed. Such a process can of course only be implementedin cases where both types of interfaces are available at the card and atthe location of use. Preferably the terminal and IC card are adaptedsuch that the update information is transferred securely from theterminal to the IC card. Such a connection for securely transferring caninclude an error detection mechanism.

Embodiments of the present invention also provide a system for updatinga parameter of a secondary application, e.g. deblocking a dormantapplication on an IC card device during a transaction of a primaryapplication between an issuer node and the IC card device via a terminalacross a network, the system being adapted to route update informationfor the change of parameter of the secondary application, e.g. fordeblocking of the blocked secondary application, through the network tothe IC card device during a transaction of the primary application, eachtransaction being routed at an application layer from the issuer node tothe terminal, the IC card device being issued by an issuer or an agentof the issuer, the update information being transferred by the terminalto the IC card device associated to a command of the primaryapplication, and the IC card device being adapted to record the updateinformation in non-volatile memory to thereby change the parameter ofthe secondary application, e.g. to thereby deblock the dormantapplication.

The updating of the secondary application occurs while the primaryapplication is active. The systems can be one where only one applicationon the IC card device can be active at one time.

A wireless and/or a wired connection can be used between the terminaland the IC card. In some cases a combination of wireless and wiredcommunication may be used to further increase the level of security. Apredefined sequence of commands may be for instance required to betransmitted or received individually over a certain interface. If theexpected predefined sequence of commands is not maintained a securitybreach may be assumed. Such a process can of course only be implementedin cases where both types of interfaces are available at the card and atthe location of use. Preferably the terminal and IC card are adaptedsuch that the update information is transferred securely from theterminal to the IC card. Such a connection for securely transferring caninclude an error detection mechanism.

The IC card can be a combo-or combicard having one microprocessor andassociated non-volatile and volatile memory. The IC card can be apayment device.

Embodiments of the present invention also provide an IC card devicehaving at least a processor and a non-volatile memory, the IC carddevice being for use in a transaction of a primary application betweenan issuer node and the IC card device via a terminal across a network,the IC card device being adapted to process each transaction deliveredat an application layer from the issuer node to the terminal, the ICcard device being issued by an issuer or an agent of the issuer, the ICcard device being adapted to receive update information transferred fromthe terminal to the IC card device associated to a command of theprimary application, and the IC card device being adapted to record theupdate information in the non-volatile memory to thereby change aparameter of a secondary application, e.g. to thereby deblock a dormantapplication.

Either a wireless and/or a wired connection can be used between theterminal and the IC card. Preferably the terminal and IC card areadapted such that the update information is transferred securely fromthe terminal to the IC card. Such a connection for securely transferringcan include an error detection mechanism.

The IC card can be a combo-or combicard having one microprocessor andassociated non-volatile and volatile memory. The IC card can be apayment device.

The updating of the secondary application occurs while the primaryapplication is active. The IC card device is for use in systems whereonly one application on the IC card device can be active at one time.

BRIEF DESCRIPTION OF THE DRAWINGS

Further objects, features and advantages of the invention will becomeapparent from the following detailed description taken in conjunctionwith the accompanying figures showing illustrative embodiments of theinvention, in which:

FIG. 1A is a diagram of the interacting components of a system accordingto an exemplary embodiment of the present invention;

FIG. 1B is a diagram of a transaction card incorporating integratedcircuit technology according to an exemplary embodiment of the presentinvention;

FIG. 2 is a functional block diagram of the integrated circuit sectionof the card illustrated in FIG. 1B according to an exemplary embodimentof the present invention;

FIG. 3 is a block diagram of a part of the system of FIG. 1A using thetransaction card of FIG. 1B according to an exemplary embodiment of thepresent invention;

FIG. 4 is a functional block diagram of a terminal according to anexemplary embodiment of the present invention; and

FIG. 5 and FIG. 6 show message flows in accordance with embodiments ofthe present invention.

Throughout the figures, the same reference numerals and characters,unless otherwise stated, are used to denote like features, elements,components or portions of the illustrated embodiments. Moreover, whilethe subject invention will now be described in detail with reference tothe figures, it is done so in connection with the illustrativeembodiments. It is intended that changes and modifications can be madeto the described embodiments without departing from the true scope andspirit of the subject invention as defined by the appended claims.

DEFINITIONS

The following abbreviations may be used in the description of thepresent invention:

Abbreviation Description AC Application Cryptogram AID ApplicationIdentifier APDU Application Protocol Data Unit b Binary C-APDU CommandAPDU EEPROM Electrically Erasable Programmable Read Only Memory EMVEuropay MasterCard(R) Visa FCI File Control Information ICC IntegratedCircuit Card ID Identifier MAC Message Authentication Code PAN PrimaryAccount Number PIN Personal Identification Number PTH PreviousTransaction History RFU Reserved for Future Use R-APDU Response APDUSW12 Status Word bytes 1-2 TLV Tag Length Value Var. Variable

Other abbreviations may be used referring to messages and data specifiedin the EMV specifications available at http://www.emvco.com. As usedherein, the term “payment device” is used to refer to any of a number ofdifferent payment devices such as, for example, a cash card, credit cardor debit card. A “payment device” may be an IC card device or asmartcard or any device that has an embedded processing engine andmemory such as a microchip. A smartcard is generally defined as a card(or other form of portable payment device) that has embedded in it aprocessing engine such as a microprocessor, and one or more solid statememories, or has embedded therein one or more solid state memories withnon-programmable logic circuits. The solid state memories are at leastnon-volatile memories. It is preferred if the card device has bothvolatile and non-volatile memory. The processing engine can implementcertain processing functions, such as to perform arithmeticaloperations, i.e. manipulate data stored in a solid state memory on thecard. Preferably the IC card device can execute functions such asobtaining authentication from a remote site, encryption, storing andmanipulating data, etc. In general, embodiments may be used with IC carddevices operating pursuant to the EMV specification or other paymentstandards.

Such an IC card device or smartcard can be a contact card or acontactless card. A “contact card” has a means for storing informationsuch as a microchip that can be contacted and read by a card readerthrough a physical contact of electrodes. A “contactless card” cancommunicate without the need for direct physical contact. Contactlesscards can have a means for communicating at radio frequencies. Acontactless card is also provided by a portable device such as a mobilephone or personal digital assistant (PDA) in which a smartcard such as a“SIM card” is embedded. The mobile device provides the RF technology forcommunication. A contactless card may be defined by a standard such asISO 14443. A “smartcard” can also have both a contact and a contactlessinterface and can therefore be used as both a contact and a contactlesscard.

A combocard, combicard or multi-application card is an IC card with amicroprocessor and memory that can activate more than one applicationstored on the card (but generally not at the same time).

As used herein, the term “script” refers to a command or instructionthat, when supplied to the IC card device, results in execution of partof an application installed on the IC card device. A script may be usedto set, reset, activate or deactivate, configure or reconfigure afunction of the application or of the IC card device such as a counterstored in a memory. In embodiments of the present invention a script canbe used to unblock a dormant application while a primary application isactivated.

“Data”—the present invention involves manipulation of data. Data can betransient or persistent data. Data is transient when it is lost afterpower is removed and has a lifespan limited to a single transaction.Some examples are: the Card Verification Results (CVR) and the PINVerification Status (PVS).

Data is “persistent” when it is stored in memory that provides long-termretention (such as EEPROM) and when the data has a lifespan beyond asingle transaction. Persistent data can be common to both contact andcontactless interfaces or interface specific.

A network such as a “payment network” for use with the present inventioncan be of the type that typically includes an issuer node such as anissuer server, and a terminal or more usually a plurality of terminalsconnected in the network, e.g. payment network e.g. by wireless or wiredconnections. For example, terminals can be POS terminals, merchantterminals, bank terminals, home computers, PDA's, laptops, cell phonesor mobile phones etc. Transmission across the network can be subject toerrors and/or a bandwidth limitation. This bandwidth limitation can bedue to the protocol that governs how a transaction is transmitted acrossthe network. For example, the protocol may only allow a certain bit orbyte size for certain messages such as those containing updateinformation. In a network such as a payment network each transactionsuch as a financial transaction is routed at an application layer fromthe issuer node to the terminal. A message of the transaction istransferred from the terminal to the payment device. One component of atransaction delivered to the IC card device is update information. Thisupdate information can change an entry or flag that signifies that aparameter of a secondary application has been changed, e.g. anapplication is blocked or unblocked or has another status. Recording theupdate information in non-volatile memory changes an entry or flag tothereby change the parameter of the secondary application, e.g. block,unblock or reblock an application that is to run on the IC card device.The network may use message switching rather than packet switching. Atransaction such as a financial transaction is then transferred as amessage which is routed in its entirety and as a separate entity fromthe issuer node to the IC card device. Each message contains addressinginformation, and at each node or switch of the network this informationis read and the transfer path to the next node or switch is decided.Typically each message is stored (usually on hard drive due to RAMlimitations) before being transmitted to the next node or switch. Hencethe payment network could be a ‘store-and-forward’ network.

DETAILED DESCRIPTION

Embodiments of the present invention relate to systems, apparatuses andmethods for performing transactions such as payment transactions. Inorder to explain the present invention in more detail, the presentinvention will be explained based on systems, apparatuses and methodsfor performing payment transactions using a payment device that can be acontactless or contact payment device which has a contact or contactlesscommunication interface. An example of a contactless interface is thatprovided by an integrated circuit chip embedded in a wireless mobiledevice. A contact interface can be provided by a payment card having anintegrated circuit chip that can be inserted into card reader, e.g. at apoint of sale terminal, and read by physical contact with electrodes.Embodiments of the invention may be used to conduct payment transactionsand to change a parameter of an application that is not active, e.g. tounblock, block or reblock an application stored in a payment device.

Embodiments of the present invention relate to technical solutions toaddress the problem of ease of access to more than one application on anIC circuit card to allow a parameter of an application to be updatedwhen the application is not active. In particular one problem that isaddressed is how to allow activation of a dormant application on an ICcard without requiring a specially dedicated terminal with which it iscommunicating.

Embodiments of the present invention address the issue that when aparameter of a non-activated application is to be updated, e.g. todeblock an application, the change in parameter is written tonon-volatile memory. In this process the deblocked application does nothave to be activated and in some systems cannot be activated at the sametime as the primary application.

In accordance with the system and methods of some embodiments of thepresent invention, a consumer can use an IC circuit card to makepurchases at a point of sale (“POS”) terminal. The present inventionwill mainly be described with reference to a financial transaction suchas a purchase transaction a payment card system (such as theMasterCard(R) network) from the issuer bank (i.e. the bank which issuedthe card) but the present invention is not limited thereto.

Each of the at least one POS terminals (which could be a personalcomputer, a personal digital assistant, cell phone, or the like) has aprocessor, interface hardware, and interface software configured tointeract with the IC card device e.g. payment device. If not embedded inthe interface hardware, the POS terminal may have a separate cardreader. Also part of the system are external networks for transmittingover communication lines financial and banking information. The presentinvention facilitates the purchase of goods and services at a POSterminal without using paper currency even using a dormant application.

The transaction card is preferably an integrated circuit (“IC”) card(also called a “smartcard”), which is typically the size of aconventional credit card, but which contains a processing engine such asa microprocessor, and memory, e.g. at least non-volatile memory. Thecard can be used to perform financial transactions in various modes. Inthe preferred embodiment, the payment device such as the IC card canperform more than one application, e.g. credit, debit, pre-authorizedamount or electronic cash card functions, loyalty or bonus schemes, orany combination of these. Transaction data can also be recorded on thecard.

The system, as illustrated in FIG. 1A, preferably includes a paymentdevice such as an IC card device 100, POS terminals 102, 104, acommunications network 106 and an issuing entity 108, each of which willnow be briefly described. The payment device such as the IC card device100 includes at least one primary application such as a paymentapplication which allows the payment device such as the IC card device100 to carry out financial transactions as a credit card, a debit card,a pre-authorized amount card or an electronic cash card as well as atleast dormant or blocked application. Each of the POS terminals 102, 104executes a POS terminal application, which may be integrated with anelectronic reader such as a card reader. In particular, the reader readsinformation stored in the payment device such as the IC card device 100,and the POS terminal 102, 104 acts upon the received information. Thecommunications network 106 allows the POS terminals 102, 104 tocommunicate through a payment network (as defined above but not shown)with the issuing entity 108. The communications network 106 carriesinformation from the POS terminals 102, 104 through the payment networkto the issuing entity 108 detailing sale transactions occurring at thePOS terminals 102, 104 and/or sales transactions stored on the paymentdevice such as the IC card 100, and from the issuing entity 108 backthrough the payment network to the POS terminals 102, 104 andconsequently the payment device such as the IC card device 100 approvingor denying the sale transactions.

In an alternate embodiment, an agent (not shown) of the issuing entity108, acting on behalf of the issuing entity 108, may communicate withthe communications network 106 without involving the issuing entity 108directly in the transaction.

Preferably, the communications network 106 is a telecommunicationnetwork and/or private network. The issuing entity 108 maintains anaccount or similar authorization which supports any use of the IC carddevice for financial transaction. FIG. 1B illustrates one type ofpayment device such as an IC card device 100. The transaction card 100incorporates integrated circuit technology into a conventional creditcard. The transaction card 100 looks similar to a conventional creditcard, but also includes an integrated circuit (“IC”) 122, which containsa microprocessor, and electrical contacts 124 for communications betweenthe IC 122 and devices external to the transaction card 100. Thetransaction card 100 can be used as a cash card, a credit card and/or adebit card or for other applications. Similar to a conventional creditcard, the front side of the transaction card 100 preferably contains thename 112 a of a financial institution that issues the card and/or thename 112 b of a payment system (e.g. MasterCard(R)) under whoseauthority the card is issued, a cardholder's account number 114, thecardholder's name 118, dates 116 between which the card is valid andusable, and a brand 120 associated with the payment system.

In an alternate embodiment, the transaction card 100 may be replaced byany integrated circuit device. The integrated circuit device may have aform factor different than that of the transaction card 100. Theintegrated circuit device can be a mini-card, a key fob, a contactlessIC card, and the like. The integrated circuit device includes the IC122, which may not be visible. The integrated circuit device may utilizeelectrical contacts 124 for communications between the IC 122 anddevices external to the integrated circuit device. Alternatively, theintegrated circuit device may utilize different modes of communicationwith external devices including radio frequency communication andinduction field communication.

In an alternate embodiment, the transaction card 100 may be replaced bya mobile wireless device such as a mobile phone, smartphone, PDA etc.that contains an integrated circuit device.

FIG. 2 is a functional block diagram of an integrated circuit devicethat can be included in the payment device such as the IC 122 andcontains at least processing unit 210 and memory unit 250. Preferably,the IC 122 also includes control logic 220, a timer 230, andinput/output ports 240. The IC 122 can also include a co-processor 260.Control logic 220 provides, in conjunction with processing unit 210, thecontrol necessary to handle communications between memory unit 250 andthe input/output ports 240. The timer 230 provides a timing referencesignal to processing unit 210 and control logic 220. Co-processor 260provides the ability to perform complex computations in real time, suchas those required by cryptographic algorithms.

Memory unit 250 may include different types of memory, such as volatileand non-volatile memory and read-only and programmable memory. Memoryunit 250 stores transaction card data such as secret cryptographic keysand optionally a user's personal identification information such as aPersonal Identification Number (“PIN”). Other forms of personalidentification information can be stored such as biometric data. Thesecret cryptographic keys may be generated by any type of well-knowncryptographic algorithm, such as the private keys of public-private keypairs or the keys of symmetrical encryption algorithms. Preferably, thesecret cryptographic keys and optionally the user's personalidentification information such as a PIN or biometric are stored in asecure area of EEPROM that is either not accessible or has very limitedaccessibility from outside the payment device such as the IC carddevice. Memory unit 250 stores the operating system of the IC card. Theoperating system loads and executes IC card applications and providesfile management or other basic card services to the IC cardapplications. One operating system that can be used to implement thepresent invention is the MULTOS™ operating system licensed by MAOSCOLtd. Preferably, the operating system is stored in ROM 251.

The non-volatile memory contains values for parameters that are ofsignificance for each application. Preferably each application has itsown reserved memory space that under normal circumstances cannot beaccessed by any other application. This means e.g. that application thatis active has accesses to memory space A; and application B that isactive has access to memory space B. For example the non-volatile memorycan contain data that signifies whether an application is blocked ornot. Access to this part of the non-volatile memory is generally onlyaccessible by the application for which the parameter(s) are relevant.Access to this part of memory may be made secure by encryption keys suchas symmetrical keys. In accordance with embodiments of the presentinvention a part of the non-volatile memory assigned to a secondaryapplication can be accessed by a primary application when active asdescribed below.

In an alternate embodiment, flash memory or other non-volatile and/orvolatile types of memory may also be used in the memory unit 250.

In addition to the basic services provided by the operating system,memory unit 250 may also include one or more IC card applications. Forexample, a MasterCard(R) M/Chip or M/Chip Advance application or asimilar Credit/Debit application could be stored on card 100.Additionally, if the IC card is to be used as an electronic cash card,the MONDEX™ electronic cash application might be included on the ICcard, which electronically loads onto the IC card a value of a certaincurrency from a cardholder's account in a financial institution. Anapplication may include both program and data files, which may be storedin either ROM or EEPROM. Any of the above applications may be dormant asissued to the user. A dormant application cannot be activated by theuser at a normal POS terminal.

Preferably, the memory unit 250 includes at least one unblocked primaryapplication such as a payment application. The payment application canconfigure the transaction card 100 to behave like a credit card, a debitcard, a pre-authorized amount card or a cash card. The memory mayinclude at least one blocked application.

FIG. 3 is a block diagram of a system 300 for reading information fromthe IC card device. System 300 includes a terminal 320. The term“terminal” generically describes devices with which the payment devicesuch as an IC card device may communicate such as a kiosk-type interfaceterminal, a personal computer, a PDA, a mobile device, or a POSterminal, etc.

Within terminal 320 are interface unit 322 and processor 326. Interfaceunit 322 may consist of a combination of hardware and software,including a display screen, designed to communicate with a cardholder,and buttons keypads, or keyboards with which a cardholder inputs data tothe terminal. Interface unit 322 may also include a card reader intowhich the cardholder inserts card 100 in order to exchange data.Alternatively, the card reader could be external to interface unit 322as shown by card reader 310.

Processor 326 communicates with interface unit 322 and processes thecommands and data provided to the terminal by the cardholder. Processor326 also communicates with devices outside of the terminal and notdirectly accessible to the cardholder such as external network 330. Thiscommunication can be accomplished, for example, using standardshort-distance and long-distance communication networks such aslocal-area and wide-area networks, or via telephone-based or wirelesscommunication lines or dedicated transmission lines. The externalnetwork 330 may allow the terminal 320 to communicate with an exchangerate information computer 336, and the like.

Terminal 320 can be located in a store or other commercial establishmentthat accepts card 100 for the purchase of goods and services. Processor326 can communicate with devices external to terminal 320 such as creditor debit card processing networks (not shown), to which credit, debit orpre-authorized amount card information can be sent and verification forthe purchase can be received. This communication can be accomplishedusing conventional credit and debit card processing methods.

In a preferred embodiment, at least one dormant application on the ICcard device can be unblocked, i.e. an entry or flag stored innon-volatile memory on the IC card 100 and accessible by the dormantapplication when active can be altered, i.e. unblocking, blocking orreblocking.

FIG. 4 is a block diagram of a transaction terminal. Each terminal 520includes processor 524, connected to both memory 522 and interactionpanel 526. Interaction panel 526 includes the display screens, thebuttons with which menu options are chosen, the keypad or keyboard, thecard receptacle or the card reader, the receipt dispenser or printer,and the refund dispenser. Processor 524 processes, controls, and outputsdata to interact with the user via interaction panel 526. Processor 524also controls memory 522 which stores dynamic information such as theoptions chosen by the cardholder during the current session andoptionally the cardholder personal identification information such asthe PIN, and static information such as transaction history.

An illustrative embodiment of the present invention will be describedincluding Integrated circuit cards, that have been issued by an Issuer,the cards being able to run several M/Chip applications, i.e. they arecombo cards or combicards. The payment applications are all controlledby the Issuer. With reference to FIG. 5, when a transaction is conductedonline to the issuer via a primary application “x”, the issuer updates,e.g. with a script in a response from the Issuer such as anauthorization response, parameters of another application “y”. Such anupdate of parameters can be, for example, unblocking, blocking ordeblocking of the application y.

Generally, there is a strict firewalling between applications “x” and“y” and it is not possible to modify parameters of application “y” whenapplication “x” is active. Furthermore, in some implementations securedupdates of application “y” require, to compute the MAC on the scriptcommand processed by application “y”, the knowledge of application “y”originated data (e.g. an Application Cryptogram). The EMV flow does notallow the communication of application y originated data when atransaction is conducted with application “x”. As a consequence, it isgenerally not possible to update an application parameter when atransaction is done with another application on a standard terminal.

Before application of the methods of the present invention the userobtains the necessary rights and privileges from the Issuer to be ableto use the primary and secondary applications. For example, the Issuermaintains a database which records bibliographic data with respect toeach user as well as personal indicators such as PIN codes or biometricdata such a iris scan, fingerprint etc. In addition the rights andprivileges of each user are recorded. For example, the database willinclude information as to whether a specific application for the IC carddevice is available to the user or whether it is blocked. The user maychange the parameters recorded in the database by any suitable method,e.g. by making a request by telephone, by a Short Message Service, byemail, by filing in a form on a web-based application or in person at abank, etc.

By means of embodiments of the present invention it is possible toaddress a script command to application “x” (the receiving application)from the network, e.g. from a terminal which will, eventually, updateparameters of application “y” (the target application). In anembodiment, the security of the script command can be ensured by thereceiving application without any loss of security as:

-   -   1. The protection of script commands uses identical        cryptographic mechanisms for both applications. However, the        same keys need not be used.    -   2. The same issuer is controlling both applications.

The present invention includes an optional limitation on any methodsystem or IC card device according to the invention, that the updatingof a second application (or further applications) when a firstapplication is active is limited to the situation where the same issueris controlling each and/or every application.

The present invention includes an optional limitation that a secondapplication cannot be active when a first application is active.

In general, embodiments provide a single payment card with multiplepayment applications stored on an IC chip. In the following description,a specific IC card, configured pursuant to the EMV standards (andfurther pursuant to MasterCard's M/Chip4 specifications) is describedincluding several data elements, and commands which may be used to allowapplications to be modified on the IC card. The illustrative embodimentallows the cardholder to select their preferred payment option indifferent environments, including, for example, at EMV compatible POSterminals, at EMV compatible ATM terminals, or in online transactions(e.g., via MasterCard SecureCode or based on a distinct primary accountnumber associated with the card). The ability to activate or enabledifferent applications at non-dedicated terminals provides cardholderswith more choice, convenience and flexibility.

Referring now to FIG. 6, embodiments of the present invention use ascript command for inter-application communication on the IC carddevice. In general, the inter-application communication is an on-cardmechanism. To achieve this, a command that is used to store data innon-volatile memory such as a “Put Data” command can be used for a newdata element. Pursuant to some embodiments, this data element has thefollowing fields:

Meta Data has the following format:

Field Length Values Version Number 1 ‘00’ Other values RFU. Update FieldVar. See below.

The purpose of the meta data is to inform the active primary applicationthat the data sent with the request is for a secondary inactiveapplication. Hence the most important field is the Update Field whichcontrols this process.

Embodiments of the present invention can include the limitation thatonly certain requests sent from the IC card device to the issuer can bethe trigger for the Issuer to send the script to update a parameter of asecondary application on the card. For example the script can beincluded in the response from the Issuer to an authorisation requestfrom the IC card device.

For Version Number ‘00’, Update Field has the following format:

Field Length Values Target Application 1 ‘00’: This Application ‘yy’:Application yy ‘FF’: By AID Length of AID (only present if 1 ‘05’-‘10’Target Application = ‘FF’) AID (only present if Target ‘05’-‘10’ AID ofTarget Application Application = ‘FF’) Target Data ID 2 ID of data toupdate/process New Value Var. Value of data to update/process

The target application has to be defined, that is, it is required tospecify whether the update is for the active primary application (value“00”) or for a secondary inactive application on the card. The secondaryinactive application can be defined by any of a variety of methods suchas by an index in a table (“yy”), by reference to an Application ID(“FF”), etc. If an Application ID (“AID”) is to be used, a separatefield can provide the length of the AID. Similarly the target data (theparameter to be updated), may also be specified by an identificationsuch as the Target Data ID. The value to be updated is specified in theNew Value field. This value will be written into the non-volatile memoryat the appropriate position. For example, to be able to write a valueinto a part of the non-volatile memory reserved for the secondaryapplication, the IC card device is adapted—for example, themicroprocessor and programs running thereon are adapted to sharenecessary keys between the primary and secondary applications and to beable to access this part of the non-volatile memory. In some cases aparameter change may not involve a direct communication between twoapplications. It may, e.g., suffice that the active application whenpresenting a predefined key known to the second application is permittedto change a certain e.g. predefined parameter value that is present in amemory location that can only be accessed by the second application whenit is active.

This target data is defined in the next fields.

The following Target Data IDs may be supported:

Target Data ID Name Length Values ‘0000’ Block Status 1 ‘00’: Unblocked‘01’: Blocked Other values RFU ‘00A5’ FCI Proprietary Var. Any EMVTemplate Compliant Value

For example if the Target Data ID field is ‘00A5’, the FCI is to beupdated with the New Value provided in the following bytes of the UpdateField. This value is shown as “Any EMV Compliant Value”. When an updateof the FCI data is performed, the FCI of the target application ismodified. This data is used by the application for payments, and is oneexample of the kind of data that can be updated using embodiments of thepresent invention. For clarity, “Any EMV Compliant Value” in the tableabove generally refers to any FCI value allowed by the EMV standards,and the target application will just replace the current FCI value withthe new value.

As a second example, if the Target Data ID is ‘0000’, then an update ofthe Block Status is performed and the target application is either“blocked” (if the New Value is ‘01’) or “unblocked” (if the New Value is‘00’).

The value to be written into the non-volatile memory based on the targetdata ID and that is associated with the secondary application is aparameter of the secondary application. For example it can define thatthis application is blocked or unblocked. By setting these values anapplication can be unblocked, blocked or reblocked.

The user should be able to see any unblocked application when using thecard with a terminal. For this purpose the appropriate displaycharacters are defined as the FCI Proprietary template. These will bedisplayed, e.g. on an LED or LCD display at the POS or ATM terminal andmeans can be provided for the user to select which application he or shewishes to use. Such a means can be a keypad or similar. For example, acardholder carrying a combo card pursuant to the present invention maypresent the card for use at a POS terminal or ATM terminal to conduct atransaction. Once the card data has been read (for example, pursuant toan EMV compliant interaction between the card and a reader associatedwith the terminal), a display device at the terminal may offer thecardholder a choice to use any of the unblocked applications on the card(e.g., credit, debit or the like). The cardholder may then interact withthe terminal to select which payment application she wishes to use forthe transaction. This provides cardholders with an ability to usedifferent payment applications from just a single payment card.

Referring again to the data elements and in particular to the addressingof a target application pursuant to some embodiments, target addressingmay be implemented as follows, all of which are embodiments of thepresent invention.

An example of how the addressing of the target application can beimplemented is as follows. The skilled person will appreciate that thisis just one example and various alternatives could be conceived by theskilled person.

Target Application=‘00’ (The primary Application that is active)

The target application is the application currently selected.

Target Application=‘yy’ (Application ‘yy’)

The target application is application ‘yy’ which is not active, e.g. isa dormant application. This assumes that applications are assignedcharacters such as alphanumeric characters or numbers known to theIssuer.

Target Application=‘FF’ (By AID)

In this case, an AID is present in the Update Field. The targetapplication is the application with this AID. In general, a full matchis required between the AIDs in order to perform an update.

Pursuant to some embodiments, the “Put Data” is processed on the MetaData as follows. The following description relates to commands and dataelements associated with MasterCard International's M/Chip4 standard,and are used for illustrative purposes only; those skilled in the art,upon reading this disclosure, will appreciate that similar processingmay be performed in other environments to allow the update ofapplications pursuant to the present invention. In the following, pseudocode is described for processing an update of data to a card whichrefers to a “PTH” data element such as that used in the M/Chip4standard. The PTH data element is generally used to store variouselements of data (such as information regarding whether an applicationis blocked, whether a script has previously failed, etc.). Otherstandards or payment card specifications may provide a similar datastorage element. Reference to the “PTH” element is for illustrativepurposes only.

In the following pseudo code, several conventions are used (which followthose generally used in M/Chip4 standard), as follows. To refer to aspecific byte of a multi-byte data element, a byte index is used underbrackets (i.e. “[_]”). For example, Card Verification Results [4]represents the 4th byte of the Card Verification Results. The first byteof a data element has index 1. To refer to a specific bit of a multi-bitdata element, a bit index is used under brackets “[_]”. For example,Previous Transaction History [7] represents the 7th bit of the PreviousTransaction History. The first bit of a data element has index 1. Torefer to a specific bit of a multi-byte data element, a byte index and abit index are used under brackets (i.e. [_][_]). For example, CardVerification Results [2][4] represents the 4th bit of byte 2 of the CardVerification Results.

The pseudo code “SAVE Previous Transaction History [1] (‘1b’)” means thefollowing occurs “Change the value of the 1st bit of the PTH to 1(binary), keep the value of the other bits unchanged. Then save this newvalue of the PTH in non-volatile memory.” Note that if PTH[1] wasalready set to 1 (binary) there is no actual change in the value, but itdoes not matter here, we want to force the value of the bit after theprocessing, irrespective of the initial value.

The Target Application is found as described above for Targetapplication addressing.

If the Target Application does not exist, ‘script failed’ is set in PTHof Receiving Application (where the storage element PTH is used to storethe outcome of the attempt to update the target application—if theattempt fails, the PTH stores that fact to be communicated to the issuerin a subsequent transaction, for example):

SAVE Previous Transaction History [1](‘1b’) and reject C-APDU (‘6985’).

If the Target Application is disabled (Previous Transaction History [6]in Target

Application=‘1b ’), ‘script failed’ is set in PTH of ReceivingApplication (in general, a “disabled” application is dead, and cannot beunblocked, and this check just confirms—if the application is dead,don't update it):

-   -   SAVE Previous Transaction History [1](‘1b’)    -   and reject C-APDU (‘6985’).

If the Target Data ID=‘0000’ (Block Status)

-   -   If Block Status Value=‘00’ (Unblocked)        -   Unblock Target Application:        -   SAVE Previous Transaction History [5](‘0b’) in Target            Application (in this step, the PTH is used to store the            “blocked”/“not blocked” status of the target application).    -   If Block Status Value=‘01’ (Blocked)        -   Block Target Application:        -   SAVE Previous Transaction History [5](‘1b’) in Target            Application.    -   If Block Status Value=Other value:        -   set ‘script failed’ in PTH of Receiving Application:        -   SAVE Previous Transaction History [1](‘1b’)        -   and reject C-APDU (‘6985’).

If the Target Data ID=‘00A5’ (FCI Proprietary Template) (in thisprocessing step, the FCI of the target application is updated. Themechanism can be used to update many other parameters, however, in thisembodiment, the processing is illustrated as only affecting the FCI.)

-   -   Replace the value field of the FCI Proprietary Template (Tag        ‘A5’) in the FCI (Tag ‘6F’) of the Target Application with the        new value.    -   Update the length of the FCI Proprietary Template (Tag ‘A5’) in        the FCI to reflect the replacement.    -   Update the length of the FCI Template (Tag ‘6F’) to reflect the        replacement.    -   If error, set ‘script failed’ in PTH of Receiving Application:        -   SAVE Previous Transaction History [1](‘1b’)        -   and reject C-APDU (‘6985’).

Note: only the value of the FCI Proprietary Template is present insubfield New Value (no TLV is present).

From a script processing perspective, only the receiving application onthe IC card device has performed the script which sets: (1) the scriptfailed bit in the PTH, (2) the script received bit in the PTH, and (3)the script counter. These items are modified in the receivingapplication, but not in the target application. In general, a feature ofthe present invention is to use the tag values as Target Data ID whenupdating tagged data. For example, if other data is to be updated, theTarget Data ID used would be the identifier already defined (in thespecifications defining the application) for the data to be updated.

The above descriptions of processes herein should not be considered toimply a fixed order for performing the process steps. Rather, theprocess steps may be performed in any order that is practicable,including simultaneous performance of at least some steps. Althoughembodiments are described with reference to illustrative messages anddata elements, other message names, data elements, or the like may beused.

Embodiments may be used to provide payment cards for cardholders thatinclude a number of different applications, some of which may beinactive when issued. For example, a cardholder may be issued a cardthat has a debit application activated at issuance, but that also hasone or more dormant applications thereon, such as a credit application,a prepaid application, a commercial credit application, a decoupleddebit application, and a loyalty application. As the cardholder buildscredit or becomes interested in activating other applications, thoseapplications can be activated at normal transaction terminals.Embodiments allow interactions with an active application to modifydetails of inactive applications in order to activate those inactiveapplications.

Although the present invention has been described in connection withspecific exemplary embodiments, it should be understood that variouschanges, substitutions, and alterations apparent to those skilled in theart can be made to the disclosed embodiments without departing from thespirit and scope of the invention as set forth in the appended claims.

What is claimed is:
 1. A method comprising: receiving an authorizationrequest at an issuer; sending an authorization response from the issuer,the authorization response including a script, the script for beingperformed by a primary application on a payment device to cause anupdate to a parameter associated with a secondary application on thepayment device.
 2. The method of claim 1, wherein the secondaryapplication is a dormant application and the script is for unblockingthe dormant application.
 3. The method of claim 1, wherein the script isfor blocking or unblocking the secondary application.
 4. The method ofclaim 1, wherein the payment device is an integrated circuit (IC) card.5. The method of claim 1, wherein at least one of the applications is atleast one of a credit application, a debit application, a loyaltyapplication and a prepaid application.
 6. The method of claim 1, whereinthe script includes data which identifies the secondary application as atarget application for the update.
 7. The method of claim 1, wherein thescript includes a data field which contains an updated value for theparameter.
 8. The method of claim 1, further comprising: prior to saidreceiving step, receiving an indication from a user of the paymentdevice to indicate that the user desires to update the parameter.
 9. Themethod of claim 8, wherein the indication from the user is received viatelephone, Short Message Service, email, web-based application or bycommunication in person.
 10. A method comprising: storing a firstapplication in a payment device; reserving a first memory area for useby the first application, access to the first memory area controlled bya first key, the first memory area in a nonvolatile memory included inthe payment device; storing a second application in the payment device;reserving a second memory area for use by the second application, accessto the second memory area controlled by a second key, the second memoryarea in a nonvolatile memory included in the payment device; sharing thesecond key with the first application; using the first key by the firstapplication to update a parameter of the second application in thesecond memory area by performing a script received by the paymentdevice.
 11. The method of claim 10, wherein the updated parameterunblocks the second application.
 12. The method of claim 10, wherein theupdated parameter blocks the second application.
 13. The method of claim10, wherein the script was generated by an issuer of a payment account.14. The method of claim 13, wherein at least one of the applications isa payment application.
 15. The method of claim 10, wherein the paymentdevice is an integrated circuit (IC) card.
 16. A method comprising:receiving a script in a payment device; reading the received script by afirst application that is active in the payment device to identify asecond application that is stored in the payment device; and storing, bythe first application, parameter data from the script in a memory areareserved for the second application.
 17. The method of claim 16, whereinthe second application is dormant when the script is received in thepayment device.
 18. The method of claim 17, wherein the storing of theparameter data in the memory area reserved for the second applicationcauses the second application to be unblocked.
 19. The method of claim16, wherein the storing of the parameter data in the memory areareserved for the second application causes the second application to beblocked.
 20. The method of claim 16, wherein the payment device is anintegrated circuit (IC) card.